Information Security Statement

Effective 9 July 2026

Security is foundational to DeCompass. This statement summarises the technical and organisational measures Safe Welkin Limited uses to protect the Platform and customer data. For responsible vulnerability disclosure, see our Vulnerability Disclosure Programme.

1. Governance

Our information security programme is aligned with ISO/IEC 27001 and underpinned by documented policies, defined roles and responsibilities, and regular management review. Staff receive security awareness training and are bound by confidentiality obligations.

2. Data protection

• Encryption in transit — TLS 1.2+ for all connections.

• Encryption at rest — industry-standard encryption for stored data and backups.

• Secrets management — credentials and keys held in a managed vault with rotation.

• Tenant isolation — logical separation of each customer's data.

3. Access control

Access follows least-privilege and need-to-know principles, with role-based access control, multi-factor authentication for administrative access, and regular access reviews.

4. Infrastructure & resilience

The Platform runs on reputable cloud infrastructure with network segmentation, firewalling, automated backups and disaster-recovery procedures. We monitor systems continuously and maintain logging and alerting.

5. Secure development

We follow secure-by-design practices, including code review, dependency and vulnerability scanning, and separation of environments. Changes are tested before release.

6. Testing & assurance

We perform regular vulnerability scanning and periodic independent penetration testing and remediate findings on a risk-prioritized basis.

7. Incident response

We maintain an incident response plan covering detection, containment, eradication, recovery and notification. Customers are notified of incidents affecting their data without undue delay, consistent with our Data Processing Agreement.

8. Contact

Security queries and reports: [email protected].